Project Management (follow-up)

City of York Council

Internal Audit Memo

Service Area: Corporate and Cross Cutting Date Issued: 01/12/2016 Status: Final Reference: 19120/009 1.0 Introduction and scope

1.1 Veritau issued an internal audit report on Project Management on 25 May 2016. The overall opinion was Limited Assurance and four findings were raised including three at Priority 2.

1.2 The audit examined project management arrangements within the council during a period of significant change and did not examine individual projects in detail. The audit found that whilst the underlying principles of project management at the council remained unchanged there was evidence to support that there were weaknesses in key areas. The audit also noted that since the audit had been undertaken there had been a considerable amount of work undertaken to ensure that a robust framework was in place and the council’s management team (CMT) had mandated that all project managers use the new project management toolkit – All About Projects.

1.3 As per Veritau’s follow-up procedure, re-testing of all management agreed actions should be carried out where an audit opinion is Limited Assurance or lower. Audit testing carried out was limited to the completion of actions and did not include an audit of the project registers or the content of the VERTO system.

2.0 Findings

Finding 1.1 - Formal ownership of project management

2.1 In July 2015, the re-wiring York transformation programme was placed back within directorates from the central transformation team. In order to provide clear corporate instruction on how to manage projects successfully, a new project management toolkit was launched (All About Projects, AAP).

2.2 As a result of the significant change explained at 1.2 and to ensure the responsibilities and accountabilities remained clear, CMT agreed to identify a corporate programme management structure. CMT acting as the overarching/corporate programme board meeting every two months. To effectively manage the overarching programme, a programme lead for each Directorate was to be identified. With CMT, the Directorate programme leads would manage the prioritisation process and ensure that the necessary documentation is in place for each programme. CMT would also agree a reporting mechanism that will ensure that the Executive, Audit & Governance Committee and relevant scrutiny groups have information when required.

Action taken

2.3 CMT agreed to a new framework for project management which was approved by Members of the Audit & Governance Committee in May 2016. Project Assurance leads were identified for each directorate and have established a schedule of monthly meetings. These

______________________________________________________________________

1 The fixed term post of Assistant Director Transformation and Change ended on 31 March 2016 and from 1 April 2016 there was no longer an Office of the Chief Executive function. meetings have been strengthened by extending the group on a bi-monthly basis to include other key officers (Legal, HR and Finance). A project support group has also been established. This is open to all officers of the council involved in project management. This group is run by one of the identified directorate leads and a member of CMT attends the session (commitments allowing).

2.4 Recent audit testing confirmed that project management had been on the agenda in all Directorate Management Team (DMT) meetings since May 2016 and that reports have been taken back to CMT at least every two months. Project management reports and updates have also been provided to Members and Committees as and when requested.

Finding 2.1 - Project Management Toolkit: Risk Management

2.5 The original audit reviewed the AAP toolkit including the information and templates for risk management. It was found that these did not align to the council’s approved risk management guidance.

Action taken

2.6 Whist the audit was being finalised, the risk section of the AAP toolkit was revised to ensure that it was in-line with the councils risk management guidance. Templates within VERTO (the Councils Project Management System) were also updated to reflect the corporate standards and links were embedded to the council’s online Risk Management guidance. This was again confirmed during the recent follow up work.

Finding 3.1 – Central Register for Council Projects

2.7 When the audit was conducted it was found that there was no overall register at corporate or directorate level for projects. The VERTO system was not being used to record all projects although there was a programme to roll it out across directorates.

2.8 It was agreed that DMTs would become responsible for establishing their directorate project register and the directorate lead would ensure that it was complete and up to date. Each directorate would then maintain a register of projects within their directorate which will make up their directorate programme and feed into the corporate programme. All medium and large projects would be held within VERTO as a corporate standard, making VERTO a central register for the council’s significant projects. Small projects would not necessarily be entered into VERTO but recorded and monitored within the directorate registers.

Action taken

2.9 All Directorate leads have established a project register. The size of the project has been determined by the project matrix (included as part of AAP). The project registers have been taken to DMTs to ensure completeness and all currently listed large and medium projects have been set up within the VERTO system. Establishing a clear project register for each directorate has allowed DMT to have oversight on the number of ongoing projects and the resources required. 2.10 All large and medium project managers have access to VERTO and are updating, where necessary with relevant project documentation. Large projects have also been included on the corporate KPI Machine to give oversight to senior managers. This is still a work in progress but clearly shows the direction of travel in the corporate overview and ownership of the corporate programme management structure.

Finding 4.1 – VERTO, a council-wide standard approach

2.11 At the time of the audit the VERTO system was only used by key staff with the intention to open up the system to officers within directorates. The audit found that there was no council specific user guide and no specific customisation of the system had been carried out to ensure that there were logical processes to follow within the system and that they aligned to the AAP toolkit. There was also a lack of mandatory fields to ensure that the correct fields within the system were completed.

2.12 It was agreed that VERTO would be updated to reflect the AAP templates and gateways. Work would also be carried out within the system to make it easier to navigate and a user guide (in use at a different authority) would be revised as the system was to be rolled out. CMT also agreed as part of their overall approach to programme management, that resources for VERTO going forward would be considered.

Action taken

2.13 The VERTO system has been configured so that it is aligned with the AAP processes and gateways. A number of fields have been made mandatory and these are all listed at the end of the revised user guide. The VERTO system has not been formally rolled out across directorates as outlined in the original audit, but all officers requiring access for the large and medium projects have access to the system, have access to a CYC tailored user guide and have one to one training available. CMT are reviewing the corporate resource going forward.

3.0 Conclusions

3.1 Since the original audit was completed there has been a significant amount of work undertaken to ensure that all of the agreed management actions have been completed. Most of this work has been carried out by one of the directorate leads, the identified corporate assurance lead, which has made them a single point of control. They have worked closely with Veritau to ensure all aspects of the agreed actions were implemented successfully.

3.2 Going forward CMT need to continue to review the resources required to maintain the current level of progress at all levels of the business.

3.3 All of the management actions raised within the May 2016 report are now considered complete. Where information resulting from investigation and/or audit work is made public or is provided to a third party by the client or by Veritau then this must be done on the understanding that any third party will rely on the information at its own risk. Veritau will not owe a duty of care or assume any responsibility towards anyone other than the client in relation to the information supplied. Equally, no third party may assert any rights or bring any claims against Veritau in connection with the information. Where information is provided to a named third party, the third party will keep the information confidential.